CVE-2026-116557

Summary

The WP Booking System plugin for WordPress lacks a capability check on its calendar note removal endpoint, allowing any authenticated user with Subscriber access or higher to delete arbitrary calendar notes belonging to any calendar.

Exploitability

Exploitation is straightforward for authenticated attackers with at least Subscriber privileges, as no additional authentication or privilege escalation is required beyond valid credentials.

Blast radius

An attacker could disrupt business operations by deleting critical calendar notes across multiple calendars, potentially erasing appointment reminders, availability constraints, or other essential scheduling data.

Detection

Look for AJAX requests to wpbs_action_ajax_calendar_remove_note with valid user session cookies but originating from users lacking administrative or calendar management capabilities; no specific log field or unique artefact is described in the CVE.

Prioritized remediation

Upgrade to version 2.1.0.6 or later, where the missing capability check has been fixed.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.